Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

A security professional working in the threat hunting domain recently identified a suspicious URL specifically targeting macOS users. The campaign appears to leverage a macOS variant of the well-known ClickFix technique, making it particularly noteworthy. Cognisys researchers accepted this challenge to understand this malicious code.

Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

ClickFix hijacks live Facebook sessions via fake verification and appeal flows aimed at creators: 115 pages, eight serverless exfiltration endpoints, and 103 related hostnames found by title pivot.

A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.

A ClickFix-style chain spoofs India's Ministry of Defence press-release portal, cloned with HTTrack, and routes Windows and Linux visitors to OS-specific pages that stage malware.